Bilattices and the semantics of logic programming
Journal of Logic Programming
A calculus for access control in distributed systems
ACM Transactions on Programming Languages and Systems (TOPLAS)
Kleene's three valued logics and their children
Fundamenta Informaticae
Artificial Intelligence
Flexible support for multiple access control policies
ACM Transactions on Database Systems (TODS)
An algebra for composing access control policies
ACM Transactions on Information and System Security (TISSEC)
POPL '77 Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages
The Logical Role of the Four-Valued Bilattice
LICS '98 Proceedings of the 13th Annual IEEE Symposium on Logic in Computer Science
The Process of Inconsistency Management: A Framework for Understanding
DEXA '99 Proceedings of the 10th International Workshop on Database & Expert Systems Applications
Role-Based Access Control
Defeasible security policy composition for web services
Proceedings of the fourth ACM workshop on Formal methods in security
History-based access control and secure information flow
CASSIS'04 Proceedings of the 2004 international conference on Construction and Analysis of Safe, Secure, and Interoperable Smart Devices
Specifying and reasoning about dynamic access-control policies
IJCAR'06 Proceedings of the Third international joint conference on Automated Reasoning
Expressive policy analysis with enhanced system dynamicity
Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
D-algebra for composing access control policy decisions
Proceedings of the 4th International Symposium on Information, Computer, and Communications Security
An algebra for fine-grained integration of XACML policies
Proceedings of the 14th ACM symposium on Access control models and technologies
Access control policy combining: theory meets practice
Proceedings of the 14th ACM symposium on Access control models and technologies
Handling inheritance violation for secure interoperation of heterogeneous systems
International Journal of Security and Networks
Proceedings of the 2009 ACM workshop on Secure web services
Component-based security policy design with colored Petri nets
Semantics and algebraic specification
Data protection models for service provisioning in the cloud
Proceedings of the 15th ACM symposium on Access control models and technologies
Probabilistic aspects: checking security in an imperfect world
TGC'10 Proceedings of the 5th international conference on Trustworthly global computing
Access control via belnap logic: Intuitive, expressive, and analyzable policy composition
ACM Transactions on Information and System Security (TISSEC)
Rumpole: a flexible break-glass access control model
Proceedings of the 16th ACM symposium on Access control models and technologies
A generic approach for security policies composition: position paper
Proceedings of the 7th Workshop on Programming Languages and Analysis for Security
A framework for the modular specification and orchestration of authorization policies
NordSec'10 Proceedings of the 15th Nordic conference on Information Security Technology for Applications
Science of Computer Programming
Hi-index | 0.00 |
In defining large, complex access control policies, one would like to compose sub-policies, perhaps authored by different organizations, into a single global policy. Existing policy composition approaches tend to be ad-hoc, and do not explain whether too many or too few policy combinators have been defined. We define an access controlpolicy as a four-valued predicate that maps accesses to either grant, deny, conflict, or unspecified. These correspond to the four elements of the Belnap bilattice. Functions on this bilattice are then extended to policies to serve as policy combinators. We argue that this approach provides a simple andnatural semantic framework for policy composition, with a minimal but functionally complete set of policy combinators. We define derived, higher-level operators that are convenient for the specification of access control policies, and enable the decoupling of conflict resolution from policy composition. Finally, we propose a basic query language and show that it can reduce important analyses (e.g., conflict analysis) to checks of policy refinement.